from lib.cuckoo.common.abstracts import Signature


class DestroyInputMethod(Signature):
    name = "destroy_input_method"
    description = "Attempt to obtain language files for tampering, destroying the registry related to the computer input method"
    severity = 3
    categories = ["reg"]
    authors = ["xuhy"]
    minimum = "2.0"

    regkeys_re = [
        ".*\\\\(SOFTWARE|Software)\\\\(Wow6432Node\\\\|WOW6432Node\\\\)?Microsoft\\\\CTF\\\\(TIP|KnownClasses|Compatibility)",
        ".*\\\\(SOFTWARE|Software)\\\\Microsoft\\\\(VBA\\\\|OLEAUT\\\\)",
        ".*\\\\Keyboard Layout\\\\Toggle",
        ".*\\\\(SYSTEM|System)\\\\ControlSet001\\\\Control\\\\Nls",
    ]

    dlls_re = [
        ".*(ole32|IMM32|ADVAPI32|advapi32|kernel32|shell32|OLEAUT32|user32|dwmapi|ntdll|SXS|VB6CHS).(dll|DLL)?",
    ]

    files_re = [
        ".*\\\\\System32\\\\C_\d+.NLS"
    ]

    def on_complete(self):
        for indicator in self.regkeys_re:
            for regkey in self.check_key(pattern=indicator, regex=True, all=True):
                self.mark_ioc("registry", regkey)
        for indicator in self.files_re:
            for filepath in self.check_file(pattern=indicator, regex=True, all=True):
                self.mark_ioc("file", filepath)
        for dll_re in self.dlls_re:
            for filepath in self.check_file(pattern=dll_re, regex=True, all=True):
                self.mark_ioc("file", filepath)
            for dll in self.check_dll_loaded(pattern=dll_re, regex=True, all=True):
                self.mark_ioc("dll", dll)
        return self.has_marks()
